Following the links pointed back to a reference to the Opener startup script.

Opener isn't a rootkit. No kernel extensions are installed, no system diagnostic binaries are replaced. It's written in generously commented bash. It doesn't even put a '.' in front of the files it creates.

It is truly the most non-sneaky piece of malware you could imagine - no files are hidden, no processes are renamed to look innocuous (much less concealed outright). The only sneaky measure employed is that the users that are added to the system are 'hidden' in that they don't appear in the default list of users on the login screen.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/articles/11372/33003#33003